feat(policies): load and evaluate remote policies on attestation operations

[jiparis]

This is the closing PR for #1180

This change adds the capability to load policies from remote providers, by using the chainloop://[provider-name/]policy-name syntax in the ref field in contracts.

Note that for the feature to fully work, at least one provider must be configured in the control plane deployment. If no provider is set in the ref field, the default provider will be tried.
Previously, only policies coming from local filesystem and public HTTPS were supported.

Note that I've removed policy validations during contract craft operations, since they might not be present during contract creation.

Example execution:

> chainloop wf contract update --name embedded --contract test/my-contract.yaml
WRN API contacted in insecure mode
WRN Both user credentials and $CHAINLOOP_TOKEN set. Ignoring $CHAINLOOP_TOKEN.
INF Contract updated!
┌────────────────────────────────────────────┐
│ Contract                                   │
├──────────────────────┬─────────────────────┤
│ Name                 │ embedded            │
├──────────────────────┼─────────────────────┤
│ Description          │                     │
├──────────────────────┼─────────────────────┤
│ Associated Workflows │                     │
├──────────────────────┼─────────────────────┤
│ Revision number      │ 30                  │
├──────────────────────┼─────────────────────┤
│ Revision Created At  │ 13 Aug 24 23:11 UTC │
└──────────────────────┴─────────────────────┘
┌────────────────────────────────────────────────────┐
│ {                                                  │
│   "schemaVersion": "v1",                           │
│   "policies": {                                    │
│     "materials": [                                 │
│       {                                            │
│         "ref": "chainloop://cyclonedx-banned-agpl" │
│       }                                            │
│     ],                                             │
│     "attestation": [                               │
│       {                                            │
│         "ref": "chainloop://sbom-present"          │
│       }                                            │
│     ]                                              │
│   }                                                │
│ }                                                  │
└────────────────────────────────────────────────────┘

✗ chainloop att init --name policytest --replace
WRN API contacted in insecure mode
INF Attestation initialized! now you can check its status or add materials to it
┌───────────────────┬──────────────────────────────────────┐
│ Initialized At    │ 13 Aug 24 23:11 UTC                  │
├───────────────────┼──────────────────────────────────────┤
│ Attestation ID    │ 4967926c-b527-4a91-98ae-e868ff06f31b │
│ Name              │ policytest                           │
│ Team              │                                      │
│ Project           │ myproject                            │
│ Contract Revision │ 30                                   │
└───────────────────┴──────────────────────────────────────┘

✗ chainloop att push
WRN API contacted in insecure mode
INF evaluating policy 'sbom-present' on attestation
WRN found policy violations (sbom-present) for statement
WRN  - missing SBOM material
INF push completed
┌───────────────────┬──────────────────────────────────────┐
│ Initialized At    │ 13 Aug 24 23:27 UTC                  │
├───────────────────┼──────────────────────────────────────┤
│ Attestation ID    │ 31604952-2a73-4309-bc0d-30690c841e28 │
│ Name              │ policytest                           │
│ Team              │                                      │
│ Project           │ myproject                            │
│ Contract Revision │ 30                                   │
└───────────────────┴──────────────────────────────────────┘

[migmartri]

LGTM!

[migmartri]

my only comment is that we might not be ready to make the switch to default provider since if we merge this, it would mean that all the policies that we have today up there will behave like remote providers when they were supposed to be files?

What if we do this in two steps

1 - we require passing a protocol and no protocol still means file
2 - we rewrite our examples, policies and so on to include file://
3 - we replace what no protocol means

wdyt?

[jiparis]

my only comment is that we might not be ready to make the switch to default provider since if we merge this, it would mean that all the policies that we have today up there will behave like remote providers when they were supposed to be files?

What if we do this in two steps

1 - we require passing a protocol and no protocol still means file 2 - we rewrite our examples, policies and so on to include file:// 3 - we replace what no protocol means

wdyt?

By default it will behave as before. This is the sequence:

1. check for embedded policy. If it exists, just use it.
2. check for chainloop:// protocol in ref. If it exists, it uses the remote loader
3. otherwise, it uses the default behaviour for ref, interpreting https://, env:// protocols, and defaulting to filesystem if no protocol is found.